6

Yes they can! For example, try http://whatever.bitmailendavkbec.onion which is the Bitmessage onion service with an arbitrary subdomain. Not that the subdomain is not transmitted between the Tor client and the onion server. It's the browser that sends the full host (including the subdomain) to the webserver in the request's Host header, so protocols othe ...


5

It must be done manually. There is no interaction between the Domain Name System (DNS) and Tor hidden service hostnames. See this answer about resolution of .onion domains.


4

Here is a list of custom HTTPS Everywhere rules which when installed would redirect you to the hidden service automatically where available. https://github.com/chris-barry/darkweb-everywhere


4

Apache doesn't run through Tor. It is a service that listens on the ip address(es) and port(s) you specify in its config file. If you want to configure Apache to host only hidden services, then you limit your listening IP address to 127.0.0.1: Listen 127.0.0.1:80 After that, in the VirtualHost block, you put the onion address in the ServerName. For example:...


4

HiddenServicePort corresponds to the most recent HiddenServiceDir entry. HiddenServicePort VIRTPORT [TARGET] Configure a virtual port VIRTPORT for a hidden service. You may use this option multiple times; each time applies to the service using the most recent HiddenServiceDir. By default, this option maps the virtual port to the same port on ...


3

It is the same as hosting a regular website, but it is routed through and only reachable through the tor network. You setup a website using the ngnix (reccomended for security) web server. You set it up to only listen to your localhost (127.0.0.1) so it is not reachable by the regular web. You then setup a tor server and configure it to generate a .onion ...


3

Your calculation is not fully correct. The hidden service address is encoded in Base32, which means there are 32 characters available. So there are 32^16=1.208925819614629174706176×10^24 addresses available. Even if you assume that someone has 10 billion machines and each machine needs a second for a test the whole experiment would need nearly four million ...


2

A hidden service is most useful when you wish to provide a service while trying to remain anonymous. They are also useful for users testing .onion reachability from their Tor Browser. Finally, they can be used to encourage Tor use, while incidentally limiting the visitors to the service to those capable of running Tor or using a .onion gateway site. Your ...


2

A captcha (i.e., reCAPTCHA) that must be input for every post. It's good for all kinds of spam, not just spam from Tor users. An alternative method could be to simply block Tor users from posting (but allow them to read).


2

Depends what you're doing. In practice, very little, especially if it is a low-traffic static web site. I've run low-traffic static sites on a Raspberry Pi before.


2

7100 sounds about right for the number of hidden web services that are up at any given time. It actually sounds a bit high. The 30K from Tor metrics are the aggregate data from HSDirs. The fact that a hidden service is hosted/registered on the Tor network does not mean that it points to an actual live server. 'Scanning' all possible addresses is not the ...


1

Probably not. You need command line access to the operating system to be able to set up tor to work with your site. That's if they even have Tor installed. Neither is very likely.


1

But traditionally for a regular non-onion site we usually buy hosting. Can I buy hosting for a onion site? Absolutely! You can pay for a VPS or a managed server or even co-locate your own server. Here are some things to keep in mind: If you use a VPS, what will keep you provider from viewing what's in your storage? If you use a managed server or you ...


1

To my knowledge, there is currently no way to avoid that your key, at least for a short time, is on your server in cleartext. However, the next generation onion services (V3) will allow you to do that once ticket #18098 (offline keys) has been implemented. Beware that the addresses differ from V2 addresses and you'll have to create a new onion address.


1

If your guard node is failing, you could try using a different guard node if you really really want to: How to change the entry node? But according to this answer, you shouldn't have to: Should I choose a new guard if the network is overloaded? There are security implications to changing your guard node: Why is a longer guard rotation period with fewer ...


1

Could they have made a scan of all the .onion websites in 3 hours? It is impossible in the way of brute-force attack. Because you can not check all possible variants of .onion's names. It is too many at the First and at the Second - Tor's bandwidth simply will do not give you a chance for this. You must remember, it is not an Internet, it is much-much ...


1

Assuming the program that generated the hostname for you is working properly, it should give you 2 files, once called hostname and the other called private_key. Put the 2 files in one folder, for example /home/user/tor_private. The next step is to add a reference to this folder in your torrc file. Open your torrc file (it is in /etc/tor/torrc when you use ...


1

Running a Tor relay, a Tor Browser and a web server on the same host does not make either of them more vulnerable or identifiable. But running a relay means that your IP is publicly advertised, which could get any internet-facing service on your host more 'attention' than it would get otherwise.


1

Static-host is a FreeNet, take a look. Free, distributed, anonymous.


Only top voted, non community-wiki answers of a minimum length are eligible